Karim Tabia

An Efficient Algorithm for Naive Possibilistic Classifiers with Uncertain Inputs

Possibilistic networks are graphical models particularly suitable for representing and reasoning with uncertain and incomplete information. According to the underlying interpretation of possibilistic scales, possibilistic networks are either quantitative or qualitative. In this paper, we address possibilistic-based classification with uncertain inputs. More precisely, we first analyze Jeffreys rule for revising possibility distributions by uncertain observations. Then, we propose an efficient algorithm for revising possibility distributions encoded by a naive possibilistic network. This algorithm is particularly suitable for classification with uncertain inputs since it allows classification in polynomial time using different efficient transformations of initial naive possibilistic networks.

On the combination of naive Bayes and decision trees for intrusion detection

Decision trees and naive Bayes have been recently used as classifiers for intrusion detection problems. They present good complementarities in detecting different kinds of attacks. However, both of them generate a high number of false negatives. This paper proposes a hybrid classifier that exploits complementaries between decision trees and naive Bayes. In order to reduce false negative rate, we propose to reexamine decision trees and Bayes nets outputs by an anomaly-based detection system

Jeffrey's rule of conditioning in a possibilistic framework

Conditioning, belief update and revision are important tasks for designing intelligent systems. Possibility theory is among the powerful uncertainty theories particularly suitable for representing and reasoning with uncertain and incomplete information. This paper addresses an important issue related to the possibilistic counterparts of Jeffrey’s rule of conditioning. More precisely, it addresses the existence and uniqueness of the solutions computed using the possibilistic counterparts of the so-called kinematics properties underlying Jeffrey’s rule of conditioning. We first point out that like the probabilistic framework, in the quantitative possibilistic setting, there exists a unique solution for revising a possibility distribution given the uncertainty bearing on a set of exhaustive and mutually exclusive events. However, in the qualitative possibilistic framework, the situation is different. In particular, the application of Jeffrey’s rule of conditioning does not guarantee the existence of a solution. We provide precise conditions where the uniqueness of the revised possibility distribution exists.

Bayesian Network-Based Approaches for Severe Attack Prediction and Handling IDSs’ Reliability

Probabilistic graphical models are very powerful modeling and reasoning tools. In this paper, we propose efficient Bayesian network-based approaches for two major problems in alert correlation which plays an important role in nowadays computer security infrastructures. While the use of multiple intrusion detection systems (IDSs) and complementary approaches is highly recommended to improve the overall detection rates, this inevitably rises huge amounts of alerts most of which are redundant and false alarms. The aim of this work is twofold: Firstly, we propose an approach based on Bayesian multi-nets which allow to take advantage of local influence relationships in order to improve the prediction of severe attacks. Secondly, we propose to handle the reliability of IDSs by considering the uncertainty relative to the triggered alerts. Experimental studies carried out on real and recent IDMEF alerts produced by the de facto network-based IDS Snort shows significant improvements with respect to standard Bayesian approaches. More particularly, the handling of IDSs’ reliability significantly reduces the false alarm rate which represents a crucial issue for intrusion detection development.

Inference in possibilistic network classifiers under uncertain observations

Possibilistic networks, which are compact representations of possibility distributions, are powerful tools for representing and reasoning with uncertain and incomplete information in the framework of possibility theory. They are like Bayesian networks but lie on possibility theory to deal with uncertainty, imprecision and incompleteness. While classification is a very useful task in many real world applications, possibilistic network-based classification issues are not well investigated in general and possibilistic-based classification inference with uncertain observations in particular. In this paper, we address on one hand the theoretical foundations of inference in possibilistic classifiers under uncertain inputs and propose on the other hand a novel efficient algorithm for the inference in possibilistic network-based classification under uncertain observations. We start by studying and analyzing the counterpart of Jeffrey’s rule in the framework of possibility theory. After that, we address the validity of Markov-blanket criterion in the context of possibilistic networks used for classification with uncertain inputs purposes. Finally, we propose a novel algorithm suitable for possibilistic classifiers with uncertain observations without assuming any independence relations between observations. This algorithm guarantees the same results as if classification were performed using the possibilistic counterpart of Jeffrey’s rule. Classification is achieved in polynomial time if the target variable is binary. The basic idea of our algorithm is to only search for totally plausible class instances through a series of equivalent and polynomial transformations applied on the possibilistic classifier taking into account the uncertain observations.

On the Use of Decision Trees as Behavioral Approaches in Intrusion Detection

Decision trees are well known and efficient classifiers widely used as behavioral approaches. However, most works pointed out their inefficiency in detecting novel attacks. In this paper, we address the inadequacy of decision trees for behavioral anomaly detection. We first explain why decision trees fail in detecting most of novel attacks. In particular, we provide experimental results showing that minimum description length (MDL) principle used while inducing decision trees is among the main reasons in their failure in detecting novel attacks. Then we propose relaxing MDL principle in order to build compatible decision trees more suitable for novel behavior detection. The strategy of relaxing MDL principle is to exploit additional tests/features in order to discriminate between normal behaviors and intrusive ones while standard decision trees only rely on minimum subset of tests/features. Experimental studies, carried out on real and recent http traffic and several Web attacks, show the significant improvements that can be made by relaxed MDL decision trees.

On the Analysis of Probability-Possibility Transformations: Changing Operations and Graphical Models

Representing and reasoning with uncertain information is a common topic in Artificial Intelligence. In this paper, we focus on probability-possibility transformations in the context of changing operations and graphical models. Existing works mainly propose probability-possibility transformations satisfying some desirable properties. Regarding the analysis of the behavior of these transformations with respect to changing operations (such as conditioning and marginalization), only few works addressed such issues. This paper concerns the commutativity of transformations with respect to some reasoning tasks such as marginalization and conditioning. Another crucial issue addressed in this paper is the one of probability-possibility transformations in the context of graphical models, especially the independence of events and variables.

Symmetries in itemset mining

In this paper, we describe a new framework for breaking symmetries in itemset mining problems. Symmetries are permutations between items that leave invariant the transaction database. Such kind of structural knowledge induces a partition of the search space into equivalent classes of symmetrical itemsets. Our proposed framework aims to reduce the search space of possible interesting itemsets by detecting and breaking symmetries between items. Firstly, we address symmetry discovery in transaction databases. Secondly, we propose two different approaches to break symmetries in a preprocessing step by rewriting the transaction database. This approach can be seen as an original extension of the symmetry breaking framework widely used in propositional satisfiability and constraint satisfaction problems. Finally, we show that Apriori-like algorithms can be enhanced by dynamic symmetry reasoning. Our experiments clearly show that several itemset mining instances taken from the available datasets contain such symmetries. We also provide experimental evidence that breaking such symmetries reduces the size of the output on some families of instances.

On the Use of Naive Bayesian Classifiers for Detecting Elementary and Coordinated Attacks

Bayesian networks are very powerful tools for knowledge representation and reasoning under uncertainty. This paper shows the applicability of naive Bayesian classifiers to two major problems in intrusion detection: the detection of elementary attacks and the detection of coordinated ones. We propose two models starting with stating the problems and defining the variables necessary for model building using naive Bayesian networks. In addition to the fact that the construction of such models is simple and efficient, the performance of naive Bayesian networks on a representative data is competing with the most efficient state of the art classification tools. We show how the decision rules used in naive Bayesian classifiers can be improved to detect new attacks and new anomalous activities. We experimentally show the effectiveness of these improvements on a recent Web-based traffic. Finally, we propose a naive Bayesian network-based approach especially designed to detect coordinated attacks and provide experimental results showing the effectiveness of this approach.

Symmetry-Based Pruning in Itemset Mining

In this paper, we show how symmetries, a fundamental structural property, can be used to prune the search space in itemset mining problems. Our approach is based on a dynamic integration of symmetries in APRIORI-like algorithms to prune the set of possible candidate patterns. More precisely, for a given itemset, symmetry can be applied to deduce other itemsets while preserving their properties. We also show that our symmetry-based pruning approach can be extended to the general Mannila and Toivonen pattern mining framework. Experimental results highlight the usefulness and the efficiency of our symmetry-based pruning approach.